Optimal Eta Pairing on Supersingular Genus-2 Binary Hyperelliptic Curves

This article presents a novel pairing algorithm over supersingular genus-$2$ binary hyperelliptic curves. Starting from Vercauteren’s work on optimal pairings, we describe how to exploit the action of the $2^3m$-th power Verschiebung in order to reduce the loop length of Miller’s algorithm even further than the genus-$2$ $η_T$ approach. As a proof of concept, we detail an optimized software implementation and an FPGA accelerator for computing the proposed optimal Eta pairing on a genus-$2$ hyperelliptic curve over $픽_2^367$, which satisfies the recommended security level of $128$ bits. These designs achieve favourable performance in comparison with the best known implementations of $128$-bit-security Type-1 pairings from the literature.